emotet

General

Target

0999.msg
Size

687KB
Sample

230309-rvl81scg75
MD5

fa8750ce17b4ff5baa44ee120e1db60a
SHA1

95680977004683cfc0a8b614e813ba77bfc230b5
SHA256

ff74cc3c17cf7f3ddff338a60cfe679c6c3c8f0ca5940f40e4b00c5580594b45
SHA512

79337e8aba43b5cf659d4659312ea32be478b8b377009326a710a9943cdfeb2dc688648210b92248c2a771e072d0bc7c3314086816bc60cdecae5fdc4372a324
SSDEEP

6144:Sie7JNbwmfcuHom8Hz2f//ywiWT8xVTI5wq:StbPHom8TYyCT8x5I5w

Score

10^/10

Malware Config

Extracted

Family

emotet

Botnet

Epoch4

C2

129.232.188.93:443

164.90.222.65:443

159.65.88.10:8080

172.105.226.75:8080

115.68.227.76:8080

187.63.160.88:80

169.57.156.166:8080

185.4.135.165:8080

153.126.146.25:7080

197.242.150.244:8080

139.59.126.41:443

186.194.240.217:443

103.132.242.26:8080

206.189.28.199:8080

163.44.196.120:8080

95.217.221.146:8080

159.89.202.34:443

119.59.103.152:8080

183.111.227.137:8080

201.94.166.162:443

eck1.plain

ecs1.plain

Targets

- Target
  
  Ncr.zip
- Size
  
  654KB
- MD5
  
  f391cae678c2bbf3cea7710d6ee07a2f
- SHA1
  
  f7361a93dfbf3db285878656f1b27732a94eecb8
- SHA256
  
  f44d067f6a4d8248521c7c073294680dfe8556207c1fda6c98602e6cb5ab25c2
- SHA512
  
  30bd36d0e3c7af2965a70d2d6adc10aee5e975b32a49e9d5fce83d03aeeaf4b3c436f1f6297c266dd42c02665060bd36870a1e75bb3541a0d3e9f8be9a34bdd1
- SSDEEP
  
  6144:JJNbwmfcuHom8Hz2f//ywiWT8xVTI5wqF:tbPHom8TYyCT8x5I5wK
Score

1^/10
behavioral1
- Target
  
  59127688180328585892998__2023-08-03_1113.doc
- Size
  
  504.3MB
- MD5
  
  237e055e64b8ca9b54e2217646bfc60e
- SHA1
  
  30cd06e2e15ccfb9b07d62d5f38692a8f6a9b5a4
- SHA256
  
  17eca4943b3040c47babe49d2d1f59f4852695e2348fe107ec935e38416e511b
- SHA512
  
  99ffa51951c364b941160153ea714a281ebf51cdc6307fffe9405a3ce13442352871134293e61009f3661c184f7827624afdc4ca1edc5d54c86e24b2c322b8e7
- SSDEEP
  
  6144:xPn4VZXbatu7MDogsDkHS50LdfcGcbz1f5M9KTFrMpSlMK3Ru+Q28:xP4PbNMkgg3Ru+x
Score

10^/10

emotet epoch4 banker trojan
- Emotet
  Emotet is a trojan that is primarily spread through spam emails.
  trojan banker emotet
- Process spawned unexpected child process
  This typically indicates the parent process was compromised via an exploit or macro.
- Loads dropped DLL
behavioral2

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

3

T1012

System Information Discovery

2

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Extracted

Targets

Process spawned unexpected child process

Loads dropped DLL

MITRE ATT&CK Enterprise v6

Tasks

static1

behavioral1

behavioral2